Create a shareable link for Bastion

  • Article

The Bastion Shareable Link feature lets users connect to a target resource (virtual machine or virtual machine scale set) using Azure Bastion without accessing the Azure portal. This article helps you use the Shareable Link feature to create a shareable link for an existing Azure Bastion deployment.

When a user without Azure credentials clicks a shareable link, a webpage opens that prompts the user to sign in to the target resource via RDP or SSH. Users authenticate using username and password or private key, depending on what you have configured for the target resource. The shareable link does not contain any credentials - the admin must provide sign-in credentials to the user.

By default, users in your org will have only read access to shared links. If a user has read access, they'll only be able to use and view shared links, but can't create or delete a shareable link. For more information, see the Permissions section of this article.

Considerations

  • Shareable Links isn't currently supported for peered VNETs across tenants.
  • Shareable Links isn't currently supported over Virtual WAN.
  • Shareable Links does not support connection to on-premises or non-Azure VMs and VMSS. 
  • The Standard SKU is required for this feature.
  • Bastion only supports 50 requests, including creates and deletes, for shareable links at a time.
  • Bastion only supports 500 shareable links per Bastion resource.

Prerequisites

  • Azure Bastion is deployed to your VNet. See Tutorial - Deploy Bastion using manual settings for steps.

  • Bastion must be configured to use the Standard SKU for this feature. You can update the SKU from Basic to Standard when you configure the shareable links feature.

  • The VNet in which the Bastion resource is deployed or a directly peered VNet contains the VM resource to which you want to create a shareable link.

Before you can create a shareable link to a VM, you must first enable the feature.

  1. In the Azure portal, go to your bastion resource.

  2. On your Bastion page, in the left pane, click Configuration.

    Screenshot of Configuration settings with shareable link selected.

  3. On the Configuration page, for Tier, select Standard if it isn't already selected. This feature requires the Standard SKU.

  4. Select Shareable Link from the listed features to enable the Shareable Link feature.

  5. Verify that you've selected the settings that you want, then click Apply.

  6. Bastion will immediately begin updating the settings for your bastion host. Updates will take about 10 minutes.

In this section, you specify each resource for which you want to create a shareable link

  1. In the Azure portal, go to your bastion resource.

  2. On your bastion page, in the left pane, click Shareable links. Click + Add to open the Create shareable link page.

    Screenshot shareable links page with + add.

  3. On the Create shareable link page, select the resources for which you want to create a shareable link. You can select specific resources, or you can select all. A separate shareable link will be created for each selected resource. Click Apply to create links.

    Screenshot of shareable links page to create a shareable link.

  4. Once the links are created, you can view them on the Shareable links page. The following example shows links for multiple resources. You can see that each resource has a separate link and the link status is Active. To share a link, copy it, then send it to the user. The link doesn't contain authentication credentials.

    Screenshot of shareable links page to show all available resource links.

Connect to a VM

  1. After receiving the link, the user opens the link in their browser.

  2. In the left corner, the user can select whether to see text and images copied to the clipboard. The user inputs the required information, then clicks Login to connect. A shared link doesn't contain authentication credentials. The admin must provide sign-in credentials to the user. Custom port and protocols are supported.

    Screenshot of Sign-in to bastion using the shareable link in the browser.

    Note

    If a link is no longer able to be opened, this means that someone in your organization has deleted that resource. While you'll still be able to see the shared links in your list, it will no longer connect to the target resource and will lead to a connection error. You can delete the shared link in your list, or keep it for auditing purposes.

  1. In the Azure portal, go to your Bastion resource -> Shareable Links.

  2. On the Shareable Links page, select the resource link that you want to delete, then click Delete.

    Screenshot of selecting link to delete.

Permissions

Permissions to the Shareable Link feature are configured using Access control (IAM). By default, users in your org will have only read access to shared links. If a user has read access, they'll only be able to use and view shared links, but can't create or delete a shared link.

To give someone permissions to create or delete a shared link, use the following steps:

  1. In the Azure portal, go to the Bastion host.

  2. Go to the Access control (IAM) page.

  3. In the Microsoft.Network/bastionHosts section, configure the following permissions:

    • Other: Creates shareable urls for the VMs under a bastion and returns the URLs.
    • Other: Deletes shareable urls for the provided VMs under a bastion.
    • Other: Deletes shareable urls for the provided tokens under a bastion.

    These correspond to the following PowerShell cmdlets:

    • Microsoft.Network/bastionHosts/createShareableLinks/action
    • Microsoft.Network/bastionHosts/deleteShareableLinks/action
    • Microsoft.Network/bastionHosts/deleteShareableLinksByToken/action
    • Microsoft.Network/bastionHosts/getShareableLinks/action - If this isn't enabled, the user won't be able to see a shareable link.

Next steps